Regulatory Pillar
NERC CIP-014 Substation Physical Security Construction: A Contractor Guide for Owners and Engineers
NERC CIP-014 is the federally enforceable physical security standard for transmission substations whose loss or damage could cause instability, uncontrolled separation, or cascading outages on the bulk electric system. This guide explains the regulation, the integrator versus manufacturer scope distinction, the engineering controls Langston executes, the construction sequencing under live transmission, the R-3 through R-6 obligation mapping, the procurement playbook, and the firm’s substation physical security project record. Field-grade, written by a 56-year general contractor.
Executive SummaryNERC CIP-014 is the federally enforceable physical security standard that applies to transmission substations whose loss or damage could cause instability, uncontrolled separation, or cascading outages on the bulk electric system. The standard was directed by the Federal Energy Regulatory Commission in Order 802 in March 2014, became enforceable in October 2015, and is currently in force as Reliability Standard CIP-014-3. It places six obligations on the owner: identify critical substations, obtain unaffiliated third-party verification of the identification, identify the operating personnel responsible, evaluate physical security threats and vulnerabilities, develop a physical security plan, and implement that plan. For owners and design engineers, the construction execution of CIP-014-3 is the part that goes least documented. Regulators write the obligation. Manufacturers sell the perimeter components. Cybersecurity vendors sell the monitoring software. The construction integrator that actually translates the design basis threat into a hardened, instrumented, durable substation perimeter under live transmission is the missing actor in most published guidance. Langston Construction Company is a general contractor that has been delivering substation physical security construction across investor-owned utilities, federal facilities, and renewable energy sites since well before CIP-014 was issued. This guide is written for the owner, engineer of record, and procurement officer responsible for sourcing that work.
1. What is NERC CIP-014, and what does it actually require?
NERC CIP-014 is a North American Electric Reliability Corporation Reliability Standard with the title “Physical Security.” It applies to a defined subset of transmission substations operating at 200 kV or above, plus a smaller subset of substations at 100 kV through 199 kV that meet specific transmission planning criteria. The standard does not apply to all substations on the grid. It applies to those whose loss or damage, combined with the loss of certain other elements, could result in instability, uncontrolled separation, or cascading within an Interconnection.
The regulation was directed by FERC Order 802 in March 2014, six months after the unsolved April 2013 Metcalf substation incident in California demonstrated that a coordinated physical attack on a transmission substation could cause significant outage exposure. NERC developed CIP-014-1 in 2014. FERC approved it in November 2014. Enforcement began October 1, 2015. The standard has been revised twice since: CIP-014-2 in 2015 to clarify Requirements R-1 and R-2, and the currently enforceable CIP-014-3, which incorporates clarifying changes around the third-party verification process under R-2.
The six requirements are sequential and conditional. Most substations on the grid are screened out at R-1. Those that pass through the full sequence carry an enforceable obligation chain.
R-1: Risk assessment
The transmission owner performs a study to identify substations whose loss or damage, when combined with the loss of certain other elements, could cause instability, uncontrolled separation, or cascading. The methodology is dictated by the standard’s referenced criteria. The output is a list of in-scope substations.
R-2: Unaffiliated third-party verification
An entity that is neither the transmission owner nor an affiliate of the transmission owner reviews and confirms the R-1 risk assessment. This is the single requirement most often misunderstood: it is not a peer review by a different department, it is a contractually independent third-party assurance review, and CIP-014-3 specifies what that independence means.
R-3: Identification of operating personnel
The transmission owner identifies the primary control center responsible for operating each in-scope substation. Operations control room and field operations personnel are identified.
R-4: Threat and vulnerability evaluation
The transmission owner conducts an evaluation of the threats to and vulnerabilities of each in-scope substation, considering prior history of attack, intelligence reports, the unique characteristics of the substation, and the existing physical security posture.
R-5: Development of a physical security plan
The plan is informed by R-4 and addresses the threats and vulnerabilities identified. The plan must include, at minimum, a description of the security measures, an implementation timeline, a description of how the plan addresses the threats and vulnerabilities, and an evaluation method for ongoing effectiveness.
R-6: Implementation
The transmission owner implements the physical security plan according to the timeline established in R-5.
For a construction integrator, the operational regulatory surface is R-4, R-5, and R-6. The owner conducts the threat evaluation; the engineer of record translates that evaluation into a design; the integrator constructs and commissions the design.
2. Construction integrator versus equipment manufacturer: why this distinction matters
The substation physical security market is structurally divided. On one side are equipment manufacturers: producers of perimeter fencing, anti-ram barriers, gate hardware, intrusion detection systems, surveillance hardware, ballistic enclosures, and the precast and modular concrete walls that have become a dominant perimeter solution in the United States. On the other side are integrators: the firms that translate the owner’s design basis threat into installed, sequenced, commissioned construction.
Most published content addressing CIP-014 substation security comes from the manufacturer side. Manufacturer literature explains the product. It does not explain the construction. There is a persistent confusion in the procurement market about what an integrator does and what a manufacturer does, and this confusion produces avoidable scope gaps, schedule overruns, and post-installation rework.
The integrator role is distinct. The integrator is responsible for civil site preparation, foundation construction for posts and walls, anchor design coordination with the wall or fence manufacturer, conduit and grounding for IDS and surveillance, integration with substation grounding grid and lightning protection, gate operator coordination with access control systems, vehicle barrier civil work, lighting installation and aiming, manned gate construction, sequencing under energized substation operations, AHJ permit coordination, and warranty coordination across multiple manufacturer products. Most of this work is outside the manufacturer’s scope of supply.
A manufacturer’s terms and conditions, in the typical case, end at delivery to site. Site preparation, foundation, and integration are owner-furnished or contractor-furnished. The integrator carries that scope and the field accountability that goes with it.
When an owner specifies CIP-014 substation security construction without an integrator on the project, the resulting scope gap appears at the foundation interface, at the conduit and grounding interface, at the access control commissioning, and at the AHJ inspection. These gaps are recoverable but expensive. The cleaner procurement structure is to contract an integrator general contractor responsible for end-to-end construction execution under a single performance guarantee.
Langston Construction occupies that integrator role. The firm executes civil and structural work, coordinates a curated subcontractor network for specialty trades, holds a single performance guarantee with the owner, and absorbs the integration risk that would otherwise sit with the engineer of record or the owner.
3. Engineering controls Langston executes on a CIP-014 substation perimeter
A typical CIP-014 substation physical security build is a stack of engineering controls operating as a defense-in-depth system. The perimeter is the first layer. Detection is the second. Delay is the third. Response coordination is the fourth.
Perimeter layer
For the perimeter layer, Langston has delivered chain-link security fencing with anti-climb measures, ornamental steel fence systems, ballistic-rated fence systems, and precast concrete wall systems specified for blast resistance, ballistic resistance, or anti-climb height. The Substation Physical Security 2023 (4,100 LF Perimeter) project for Idaho Power Company, with engineer of record Zapata Group Inc., is a representative example: 4,100 linear feet of 11-foot fence with 18 technology posts and 12 technology boxes integrated to the perimeter. The Substation Physical Security 2023 project, with engineer of record Burns & McDonnell, included 2,935 linear feet of Ameristar Matrix Alpha X-Span fence integrated with UL Level 4 glass enclosures, intrusion detection, and video surveillance.
Detection layer
For the detection layer, Langston executes the civil and conduit infrastructure that supports intrusion detection systems, surveillance camera networks, and lighting. Microwave, infrared, fiber-optic vibration sensing, and buried-cable detection systems each have distinct foundation and conduit requirements. Lighting placement coordinates with camera fields of view and with shadow zones. The integrator carries the design coordination across these systems.
Delay layer
For the delay layer, Langston has installed anti-ram crash barriers, including cable barrier systems and bollard arrays rated to ASTM F2656 K-rating standards, manned gate booth construction, vehicle inspection station construction, and turnstile and barrier-arm pedestrian access points. The Turnstiles and Barrier Arms project demonstrates the pedestrian access control layer; this project demonstrates the vehicular barrier system.
Response coordination layer
For the response coordination layer, Langston coordinates control room communication infrastructure, emergency vehicle access, alarm transmission to the responsible operating personnel identified under R-3, and the conduit infrastructure for armed response coordination where the owner’s plan calls for it.
The federal facility variant of this work, exemplified by the Fort Campbell Microgrid project and the DOE Radioactive Protective Building project, layers in DoD UFC standards, DOE 10 CFR Part 835, and ALARA framing. The principles are the same; the specifications are stricter.
4. Construction sequencing under live transmission
Substation physical security construction is rarely a greenfield project. It is most often a hardening retrofit on an operating substation. This means the construction work occurs adjacent to energized 100 kV, 200 kV, 345 kV, 500 kV, or 765 kV equipment. The construction sequencing is driven by reliability constraints that have no parallel in commercial or industrial construction.
The integrator must coordinate every shutdown window with the transmission owner’s operations control room and, in most cases, with the regional Reliability Coordinator. Shutdowns are scheduled months in advance and are subject to cancellation hours before the planned outage if grid conditions require it. The integrator must absorb that schedule volatility without breaching the construction timeline committed to the owner.
Energized work proximity rules govern crane operations, post installation, fence installation, and concrete delivery. The Occupational Safety and Health Administration minimum approach distance, the National Electrical Safety Code clearances, and the transmission owner’s internal procedures all impose distinct buffers. An integrator with an experience modification rate at the safest end of the construction industry distribution is the only credible bidder for this work.
Langston has been a member of the Associated General Contractors and is the 2026 first-place winner in the AGC Construction Safety Excellence Awards Utility Division. The CSEA win followed a live presentation before judges at the AGC National Convention. The firm’s safety culture is the entry credential for energized work proximity. Without it, the project does not proceed.
The Substation Physical Security 2019 and 2021 projects, which collectively delivered fence and security infrastructure across multiple substation yards including the 230 kV and 525 kV yards, demonstrate the cadence of this work: outage windows coordinated, crews sequenced through live yards, civil and electrical handed off cleanly across multiple voltage classes.
5. R-3 through R-6 obligation mapping for the integrator
The construction integrator does not own R-1 or R-2. The transmission owner owns those. The integrator engages at R-3 and carries the field execution through R-6.
Under R-3, the integrator coordinates with the operating personnel identified by the owner. This coordination is not formal contract scope, but it is field reality. The crews must know who in the control room to call when the perimeter detection system is being commissioned, when a gate is being temporarily disabled for crane access, when a fiber pull will pass through a manned gate. The integrator’s superintendent maintains the radio and phone protocol with the operating personnel for the duration of the work.
Under R-4, the integrator does not conduct the threat and vulnerability evaluation. The owner does. The integrator does, however, translate the evaluation into procurement specifications and sequence decisions. The integrator advises the engineer of record where the construction execution can either reinforce or undermine the threat mitigation strategy.
Under R-5, the integrator is the constructor of the physical security plan. The plan is the design; the integrator builds it. The integrator’s experience tells the engineer of record where the plan, as drawn, will not survive contact with the ground: where conduit runs interfere with grounding, where camera placement creates blind spots in real lighting conditions, where AHJ requirements will modify the design.
Under R-6, the integrator is the implementer. Implementation is construction. Construction is the timeline-bound, performance-guaranteed delivery of the design as drawn, modified through the field by RFI and ASI, commissioned, and turned over to the owner. The integrator’s contract is the legal vehicle that converts the regulatory obligation into a binding deliverable.
The clean procurement structure, then, is: the owner contracts the engineer of record for design; the owner contracts the third-party verifier for R-2; the owner contracts the integrator general contractor for R-6 implementation. Three distinct contracts, three distinct accountability lines, no scope gaps at the seams.
6. Procurement playbook: how to source CIP-014 substation security construction
The procurement officer responsible for sourcing CIP-014 substation security construction faces a market with limited credible bidders. The combination of civil and structural capability, energized work safety culture, NERC CIP awareness, and interstate footprint is unusual. Most construction firms have one or two of these. Few have all four.
A defensible procurement playbook starts with a qualifications-based prequalification. The prequalification questionnaire should ask the following:
- Has the firm completed substation physical security construction projects in the past five years, with named transmission owner clients and named engineer of record partners? Request the project list. The integrator who has not done the work is not qualified to bid the work.
- What is the firm’s experience modification rate, OSHA recordable incident rate, and DART rate over the past three years? An EMR above 1.0 is disqualifying for energized work. AGC and CAGC safety awards are positive evidence.
- What is the firm’s NERC CIP awareness training program for site superintendents and project managers? An integrator that has not internalized CIP-014 vocabulary will produce coordination friction with the transmission owner’s operating personnel.
- What is the firm’s bonding capacity? Substation physical security projects routinely require performance and payment bonds at 100 percent of the contract value. Aggregate bonding capacity must comfortably exceed the project value plus existing backlog.
- What is the firm’s interstate footprint and ability to mobilize crews to the project location? CIP-014-eligible substations are concentrated in specific geographies, and a contractor whose superintendent must travel from another region adds schedule risk.
Once prequalification is complete, the bid evaluation should weight the integrator’s project record more heavily than the unit pricing. Substation physical security work is a specialty trade. The cost of getting the wrong contractor exceeds the savings of the lowest bid by an order of magnitude.
7. Langston substation physical security project record
Langston has delivered substation physical security and adjacent critical-infrastructure security construction across investor-owned utilities, public power, federal facilities, and renewable energy sites. Each of the following projects is documented as a project elsewhere on this site.
- Substation Physical Security 2023 (4,100 LF Perimeter) – Idaho Power Company, Zapata Group Inc., 4,100 linear feet of 11-foot fence, 18 technology posts, 12 technology boxes, NERC CIP-014 R-3 through R-6 framing.
- 2024 Physical Security – Renewable energy site security, perimeter integration with grid interconnection facilities.
- Substation Physical Security 2023 – Burns & McDonnell engineer of record, Ameristar Matrix Alpha X-Span 2,935 linear feet, UL Level 4 glass, intrusion detection, video surveillance, full NERC CIP-014 R-1 through R-6 framing.
- Substation Physical Security 2022 – Multi-substation perimeter and detection construction.
- Substation Physical Security 2021 (525 kV Yard) – 3,300 linear feet of perimeter and integrated detection on a high-voltage yard.
- Substation Physical Security 2021 (230 kV Yard) – 2,050 linear feet of perimeter on the adjacent 230 kV yard.
- Substation Physical Security 2020 – Substation perimeter and security infrastructure construction.
- Substation Physical Security 2019 (230 kV Yard) – 2,750 linear feet of perimeter and security infrastructure on a 230 kV yard.
- Substation Physical Security 2019 (SVC Yard) – 1,100 linear feet of perimeter on the SVC yard.
- Substation Physical Security 2017 – Substation perimeter and security construction.
- Substation Physical Security 2016 – Substation perimeter and security construction.
- Fort Campbell Microgrid – DoD critical infrastructure, three 12-by-54-foot-6 generator pads, UFC 3-540-01, UFC 3-460-01, UFC 4-022-01 framing.
- DOE Radioactive Protective Building – 23,520 square feet, Seneca SC, DOE 10 CFR Part 835 and ALARA framing.
- Turnstiles and Barrier Arms for Unparalleled Security – Pedestrian access control layer for a critical infrastructure perimeter.
This portfolio is the proof basis for Langston’s substation physical security construction integrator positioning. The full project list is available at the project portfolio.
8. Frequently asked questions
Does NERC CIP-014 apply to all transmission substations?
No. NERC CIP-014 applies to a specific subset of transmission substations identified through the R-1 risk assessment. Most substations on the bulk electric system are screened out at R-1. The standard primarily applies to substations operating at 200 kV or above whose loss or damage, combined with the loss of other elements, could cause instability, uncontrolled separation, or cascading. A smaller subset of substations at 100 kV to 199 kV may also fall in scope based on transmission planning criteria.
Who performs the R-2 unaffiliated third-party verification?
R-2 requires that the R-1 risk assessment be reviewed by an entity that is not the transmission owner and not an affiliate of the transmission owner. The verifier is typically a registered professional engineering firm or a specialized consulting firm with bulk electric system planning expertise. The verifier reviews the R-1 methodology and the resulting list of in-scope substations. Langston Construction is not a verifier and does not perform R-2 work; this is a separate procurement.
What does a construction integrator do that a perimeter manufacturer does not?
A perimeter manufacturer supplies the product, typically delivered to site under product-specific terms and conditions. The integrator performs civil site preparation, foundation construction, anchor coordination, conduit and grounding, integration with substation grounding grid, gate operator and access control commissioning, AHJ permit coordination, warranty coordination across multiple manufacturer products, and overall project sequencing under live transmission. Most of this scope is outside the manufacturer’s scope of supply.
Can the engineer of record act as the construction integrator?
Engineering and construction are distinct services. Some firms, including major EPC contractors, hold both. Most engineers of record do not delivers construction and instead specify and oversee a construction contractor. The cleaner procurement structure for most owners is to contract the engineer of record and the construction integrator as separate parties under separate contracts.
How is CIP-014 substation construction different from non-regulated substation construction?
The construction methods are similar. The procedural envelope is different. CIP-014 substations operate under an enforceable physical security plan, which means construction work that affects the perimeter, the detection systems, or the access control systems must coordinate with the plan. Temporary perimeter compromises during construction must be authorized and compensated for. Plan revisions triggered by construction must flow back into the documented physical security plan. The integrator’s documentation discipline is more rigorous than for non-regulated substation work.
What states does Langston operate in?
Langston Construction operates as of 2026: South Carolina (headquarters), Georgia, North Carolina, Florida, Tennessee, Virginia, Alabama, Mississippi, Texas, Idaho, Oregon, Arizona, Nevada, Utah, Indiana, and Illinois. The firm is licensed and bonded in each state and executes civil and structural construction across the full footprint.
Does Langston perform CIP-014 work for cooperative and municipal utilities, or only investor-owned?
Langston has delivered substation physical security construction for investor-owned utilities, public power systems, and rural cooperatives. The CIP-014 obligations apply to the transmission owner regardless of ownership form. The construction execution requirements are the same.
How does Langston coordinate with the AHJ on local code variations?
The AHJ for substation physical security construction is typically the local building department, sometimes the local fire marshal for gate and access control review, and in some jurisdictions a separate utility regulatory authority. Langston’s project management discipline includes pre-bid AHJ engagement, permit submittal review, inspection coordination, and certificate of occupancy or final inspection sign-off. AHJ coordination is included in the integrator’s scope rather than left to the engineer of record.
What is the typical procurement timeline from RFP to substantial completion?
A substation physical security construction project typically runs 60 to 120 days for design verification and procurement, 90 to 180 days for construction depending on scope and outage availability, and 30 to 60 days for commissioning, training, and turnover. Langston has delivered projects faster than this envelope when the owner’s outage windows allow.
How do owners and engineers initiate a conversation with Langston about a CIP-014 project?
Direct procurement contact is the recommended path. Owners and engineers can request a project record, qualification statement, bonding letter, and pre-bid technical conversation by contacting the Langston team at the contact information below.
Talk to the Langston team about your CIP-014 project
Substation physical security construction is a specialty trade. Pre-bid technical conversations are welcome. The Langston team will respond to scoping questions, send delivered project projects, and provide bonding and qualification information on request.
[email protected]
125 Langston Rd, Piedmont SC 29673